[security]-unified-security-cost-optimizer agent and associated skills

cloudformation/devops-agent-skill-policies.yaml

@@ -36,6 +36,10 @@ Metadata:
           default: Optional Resource Scoping
         Parameters:
           - AllowedRegions
+      - Label:
+          default: Optional Add-On Permissions
+        Parameters:
+          - EnableConfigAthenaCiAnalysis
 
 Parameters:
   ExistingRoleName:
@@ -147,6 +151,30 @@ Parameters:
     Default: 'true'
     AllowedValues: ['true', 'false']
 
+  EnableConfigAthenaCiAnalysis:
+    Type: String
+    Description: >
+      Optional add-on for the config-cost-optimization skill: grants the extra permissions
+      the Athena CI-driver attribution path needs (athena query execution + results, Glue
+      Data Catalog reads, and s3:GetObject on the Config delivery data). OFF by default and
+      least-privilege. Also requires an Athena
+      workgroup configured with Athena-managed query results, because the DevOps Agent role
+      has no s3:PutObject to write results to a customer bucket. Without this add-on the
+      skill falls back to GetDiscoveredResourceCounts (labeled approximate) and the Athena
+      path returns AccessDenied. Set ConfigDataBucketArn to scope the s3:GetObject grant to
+      the Config delivery bucket; leave it at '*' only for testing.
+    AllowedValues: ['true', 'false']
+    Default: 'false'
+
+  ConfigDataBucketArn:
+    Type: String
+    Description: >
+      Bucket ARN holding the AWS Config delivery data that Athena queries (e.g.
+      arn:aws:s3:::my-config-bucket). Used only when EnableConfigAthenaCiAnalysis=true to
+      scope s3:GetObject to that bucket. Leave empty to grant s3:GetObject on all buckets
+      (testing only — not recommended).
+    Default: ''
+
 Conditions:
   CreateNewRole: !Equals [!Ref ExistingRoleName, '']
   SkillAwsHealthEvents: !Equals [!Ref EnableAwsHealthEvents, 'true']
@@ -161,6 +189,8 @@ Conditions:
   SkillAgentCoreObservabilitySetup: !Equals [!Ref EnableAgentCoreObservabilitySetup, 'true']
   SkillAgentCoreOpsReview: !Equals [!Ref EnableAgentCoreOpsReview, 'true']
   SkillSageMakerAIOpsReview: !Equals [!Ref EnableSageMakerAIOpsReview, 'true']
+  ConfigAthenaCiAnalysis: !Equals [!Ref EnableConfigAthenaCiAnalysis, 'true']
+  HasConfigDataBucketArn: !Not [!Equals [!Ref ConfigDataBucketArn, '']]
   HasRegionRestriction: !Not [!Equals [!Join ['', !Ref AllowedRegions], '']]
 
 Resources:
@@ -480,6 +510,49 @@ Resources:
               - ec2:DescribeSubnets
             Resource: '*'
 
+  # Optional add-on for config-cost-optimization: the Athena CI-driver attribution path.
+  # OFF by default (EnableConfigAthenaCiAnalysis=false). Athena alone (StartQueryExecution/
+  # GetQueryResults) is not enough to query the Config S3 data: the query engine must read
+  # the Config objects (s3:GetObject), resolve the table via the Glue Data Catalog
+  # (glue:GetTable/GetDatabase/GetPartitions), and read workgroup config (athena:GetWorkGroup).
+  # It ALSO requires an Athena workgroup configured with Athena-managed query results, because
+  # the DevOps Agent role has no s3:PutObject to write results to a customer bucket. Without
+  # all of this the path returns AccessDenied and the skill falls back to
+  # GetDiscoveredResourceCounts. Scope ConfigDataBucketArn to the Config delivery bucket.
+  PolicyConfigAthenaCiAnalysis:
+    Type: AWS::IAM::Policy
+    Condition: ConfigAthenaCiAnalysis
+    Properties:
+      PolicyName: DevOpsAgentSkill-ConfigAthenaCiAnalysis
+      Roles:
+        - !If [CreateNewRole, !Ref DevOpsAgentRole, !Ref ExistingRoleName]
+      PolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Sid: AthenaQueryExecution
+            Effect: Allow
+            Action:
+              - athena:StartQueryExecution
+              - athena:GetQueryExecution
+              - athena:GetQueryResults
+              - athena:GetWorkGroup
+            Resource: '*'
+          - Sid: GlueCatalogRead
+            Effect: Allow
+            Action:
+              - glue:GetDatabase
+              - glue:GetTable
+              - glue:GetPartitions
+            Resource: '*'
+          - Sid: ConfigDataRead
+            Effect: Allow
+            Action:
+              - s3:GetObject
+            Resource: !If
+              - HasConfigDataBucketArn
+              - !Sub '${ConfigDataBucketArn}/*'
+              - '*'
+
   # Optional: restrict agent to specific regions
   PolicyRegionalRestriction:
     Type: AWS::IAM::Policy
@@ -554,8 +627,10 @@ Outputs:
         - aws-backup-coverage-review: ${EnableAwsBackupCoverageReview} (backup:GetSupportedResourceTypes, config:SelectResourceConfig, dsql:ListClusters, storagegateway:List*)
         - agentcore-observability-setup: ${EnableAgentCoreObservabilitySetup} (bedrock-agentcore:Get/ListAgentRuntime, xray:GetTraceSegmentDestination, logs:DescribeDeliveries/DeliverySources/DeliveryDestinations/ResourcePolicies, lambda:GetFunctionConfiguration, ecs:DescribeTaskDefinition/DescribeServices/ListTasks, eks:DescribeCluster)
         - agentcore-ops-review: ${EnableAgentCoreOpsReview} (bedrock-agentcore read-only List/Get for runtimes/memories/gateways/browsers/code-interpreters/workload-identities, ec2:DescribeSubnets)
+        - config-cost-optimization Athena add-on: ${EnableConfigAthenaCiAnalysis} (athena:StartQueryExecution/GetQueryExecution/GetQueryResults, s3:GetObject on the Config data bucket; also needs an Athena-managed-results workgroup. Glue reads and athena:GetWorkGroup are already in the managed policy)
         - sagemaker-ai-ops-review: ${EnableSageMakerAIOpsReview} (savingsplans:DescribeSavingsPlans)
       Skills covered by AIDevOpsAgentAccessPolicy (no extra policy needed):
         - aws-eks-operations-review, eks-upgrade-readiness, enrich-with-aws-security-agent, crm-production-investigation-guidelines
+        - cloudtrail-cost-optimization, config-cost-optimization, guardduty-cost-optimization (ce:Get* and s3:GetLifecycleConfiguration already granted on * by the managed policy)
       No IAM required:
         - skip-scheduled-maintenance

custom-agents/unified-security-cost-optimizer/CHANGELOG.md

@@ -0,0 +1,32 @@
+# Changelog
+
+## 1.2.0
+
+- Updated the IAM prerequisites after verifying against the live
+  `AIDevOpsAgentAccessPolicy` v11: the three per-skill CloudFormation gates
+  (`EnableCloudTrailCostOptimization`, `EnableConfigCostOptimization`,
+  `EnableGuardDutyCostOptimization`) granted nothing and have been removed from the
+  template, so the README now states no additional IAM is required (only the optional,
+  off-by-default config Athena add-on adds permissions). Addresses feedback item 3.
+
+## 1.1.0
+
+- Treat all ingested resource, usage, finding, and cost data as untrusted — the
+  System Prompt now states this data must never be followed as instructions, closing a
+  prompt-injection path where a crafted tag, bucket name, or finding string could steer
+  the agent into recommending reduced CloudTrail, Config, or GuardDuty coverage.
+- Require every coverage-reducing recommendation to state its security impact and cite
+  the specific evidence (metric, API field, resource) it rests on, so a human can
+  verify independently before acting; added Security Impact and Evidence columns to the
+  consolidated report. Addresses H1 from peer review.
+
+## 1.0.0
+
+- Initial version
+- System prompt with Goal/Approach/Constraints/Output structure
+- Routes to the `cloudtrail-cost-optimization`, `config-cost-optimization`, and `guardduty-cost-optimization` skills for domain knowledge
+- Requires the `use_aws` tool for read-only resource and usage inspection
+- Read-only, security-and-compliance-first: frames every reduction as a cost-vs-risk tradeoff and defers the decision to the customer
+- Produces per-skill artifacts for single-service reviews and a consolidated `security-cost-optimization-<account-id>-<YYYY-MM-DD>.md` for multi-service reviews
+- Output includes executive summary, opportunities by service, cross-service observations, consolidated priority matrix, and next steps
+- Severity-based prioritization (CRITICAL, HIGH, MEDIUM, LOW, INFO) with estimated monthly savings

custom-agents/unified-security-cost-optimizer/README.md

@@ -0,0 +1,55 @@
+# Unified Security Cost Optimizer - Custom Agent
+
+## Purpose
+
+This custom agent helps customers reduce spend on AWS security and governance services — Amazon CloudTrail, AWS Config, and Amazon GuardDuty — without weakening their security posture. It routes each service to its dedicated cost-optimization skill, runs entirely read-only, and produces a consolidated, severity-ranked cost-optimization report with estimated savings and explicit cost-vs-risk tradeoffs. It is designed for FinOps and security teams who want to find and prioritize security-service savings across an account or organization in one pass.
+
+## Key Capabilities
+
+- Reviews Amazon CloudTrail, AWS Config, and Amazon GuardDuty cost in a single run (or any subset the user selects)
+- Detects the highest-impact drivers per service: duplicate CloudTrail management-event trails and broad data events; over-broad AWS Config recording, continuous-vs-daily frequency mismatches, and duplicate global-resource recording; and high-cost GuardDuty protection plans including the Runtime Monitoring / VPC Flow Log charge offset and free-trial cost projection
+- Attributes spend using Cost Explorer usage types and each service's CloudWatch usage metrics, and sizes each opportunity with an estimated monthly saving
+- Frames every recommendation as a cost-vs-risk tradeoff — never reducing coverage below compliance or security requirements
+- Highlights cross-service themes (e.g. shared high-volume S3 activity touching CloudTrail data events, Config delivery buckets, and GuardDuty S3 Protection)
+- Produces a consolidated Markdown report artifact for sharing with stakeholders
+
+## Prerequisites
+
+- An AWS DevOps Agent space with the target AWS account configured as a cloud source
+- **No additional IAM permissions are required.** Every read-only API the three skills use (CloudTrail, Config, GuardDuty, CloudWatch, S3, Organizations) plus `ce:GetCostAndUsage` for dollar sizing is already covered by the AWS managed [`AIDevOpsAgentAccessPolicy`](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AIDevOpsAgentAccessPolicy.html). The only optional extra is the config-cost-optimization Athena CI-driver path (`EnableConfigAthenaCiAnalysis` in [`cloudformation/devops-agent-skill-policies.yaml`](https://github.com/aws/tools-for-devops-agent/blob/main/cloudformation/devops-agent-skill-policies.yaml)), which is off by default; without it the Config skill falls back to a resource-count signal.
+- The [cloudtrail-cost-optimization skill](../../skills/cloudtrail-cost-optimization/) uploaded to your Agent Space. Important: for the skill to be used by the custom agent, choose "All agents" in the "Agent Type" field when importing the skill, even though the skill's README suggests specific agent types
+- The [config-cost-optimization skill](../../skills/config-cost-optimization/) uploaded to your Agent Space. Important: choose "All agents" in the "Agent Type" field when importing the skill
+- The [guardduty-cost-optimization skill](../../skills/guardduty-cost-optimization/) uploaded to your Agent Space. Important: choose "All agents" in the "Agent Type" field when importing the skill
+
+## Creating the Agent
+
+1. In the DevOps Agent web app, go to the "Agents" menu (on the bottom left pane)
+2. Click "Create agent" (on the right side), then in the menu that pops up, click "Form" (the left-most option)
+3. In the "Name" field, use "unified-security-cost-optimizer"
+4. Copy the content of the "SYSTEM_PROMPT.md" file from this directory, and paste it into the "System prompt" field in the custom agent creation form
+5. In the "Skills" drop-down list, select the "cloudtrail-cost-optimization", "config-cost-optimization", and "guardduty-cost-optimization" skills, and click "Create agent"
+6. Now add the `use_aws` tool — in the new custom agent's window, click "Edit"
+7. In the window that pops up, select "Chat". A new chat starts on the left side. Wait for DevOps Agent to finish thinking; it will ask what you'd like to change
+8. Type "Add the use_aws tool to this custom agent". Once the chat finishes, verify on the custom agent's page that `use_aws` is shown under "Tools"
+
+## Executing the Agent
+
+You can execute the custom agent on-demand from the custom agent page, on a schedule, or using chat. Follow the [Executing custom agents guide](https://docs.aws.amazon.com/devopsagent/latest/userguide/custom-agents-executing-custom-agents.html) for more information. You can also run it with a custom prompt — for example, ask it to review only GuardDuty, focus on a specific account/Region, or project GuardDuty free-trial cost.
+
+Example prompts:
+
+- *"Optimize the cost of my security services (CloudTrail, Config, GuardDuty) for account 123456789012."*
+- *"Where am I overspending on CloudTrail and Config across my organization?"*
+- *"Review only GuardDuty cost and project my spend after the free trial."*
+
+Once finished, the artifact is persisted on the **Artifacts** page in the DevOps Agent web app. Single-service runs use that skill's artifact name (e.g. `guardduty-cost-optimization-<account-id>-<YYYY-MM-DD>.md`); multi-service runs produce a consolidated `security-cost-optimization-<account-id>-<YYYY-MM-DD>.md`.
+
+## Related
+
+- [cloudtrail-cost-optimization skill](https://github.com/aws/tools-for-devops-agent/tree/main/skills/cloudtrail-cost-optimization) - Domain knowledge for Amazon CloudTrail cost optimization
+
+- [config-cost-optimization skill](https://github.com/aws/tools-for-devops-agent/tree/main/skills/config-cost-optimization) - Domain knowledge for AWS Config cost optimization
+
+- [guardduty-cost-optimization skill](https://github.com/aws/tools-for-devops-agent/tree/main/skills/guardduty-cost-optimization) - Domain knowledge for Amazon GuardDuty cost optimization
+
+- [AWS DevOps Agent custom agents documentation](https://docs.aws.amazon.com/devopsagent/latest/userguide/working-with-devops-agent-custom-agents-index.html)